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Recently, a chaos-based image encryption algorithm called MCKBA (Modified Chaotic-Key 
Based Algorithm) was proposed. This paper analyzes the security of MCKBA and finds that it 
can be broken with a differential attack, which requires only four chosen plain-images. Perfor- 
mance of the attack is verified by experimental results. In addition, some defects of MCKBA, 
including insensitivity with respect to changes of plain-imagc/sccrct key, are reported. 
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1. Introduction 

Rapid development of information technology and popularization of digital products require that mul- 
timedia data are transmitted over all kinds of wired/wireless networks more and more frequently. Therefore, 
secure delivery of multimedia data becomes increasingly important. However, traditional text encryption 
schemes fail to be competent for the task due to the big differences between textual and multimedia 
data. Under the pressure of this challenge, researchers attempted to propose special multimedia encryption 
schemes utilizing all kinds of nonlinear theories in the past decade. The subtle similarity between chaos 
and cryptography makes chaos considered as an ideal tool to design secure and efficient encryption schemes 
and a great numb e r of multimedia encryption schemes based on i t have been present ed Chen &: Yenl . 120031 : 



Chen et all l2004l : IPisarchik et~al\ . 120061 : IXiang et all l2007l : H, 1201(1 IWone 'et all 1201TJ] .Unfortunately 



many of them have been found to be ins ec ure and/or incomp l ete from the viewpoint of modern cryp- 
tology |Wang et all, l200fil: \U et all l2008bl B lArrovo et alj 120081; Izh^u fc AiJ IJOQsl ; lErcan fc Cahitl . l200<jl : 
Li et all l2009bl lal; ISolak et all 120101 ] . References Alvarez Sz Lil . 120061 ; iLi et all 120041 ] conclude some general 
rules a bout evaluating the security of chaos-based encryption schemes. 

In Yen &: Gud . 120001 ] . a chaotic key-based algorithm (CKBA) for image encryption was proposed. 
The algorithm encrypts each pixel by four possible operations: XORing or XNORing it with one of two 
predefined sub-keys. A pseudo-random number sequence (PRNS), obtained from a one-dimensional chaotic 
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system, is used to determine which operation is exerted. As shown in Li &: Zhend . 120021 ]. CKBA can be 
easily broken wit h only one known/chosen -image. To enhance security of CKBA against known/chosen- 
plaintext attack, [Rao fc Gangadharl . 120071 ] pr oposes a modified c haotic-key based algorithm (MCKBA) by 
employing a modu lar addition operation lik e [Socek et al\ . 120051 ] . To further enhance the security against 
brute- force attack, [Gangadhar fc Rad . 120101 ] rep laces the one-dimension al chaotic system generating PRNS 
with a simple hyperchaos generator proposed in [Takahashi et all . 120041 ] and names the algorithm HCKBA 
(Hyper Chaotic-Key Based Algorithm). Since the two schemes MCKBA and HCKBA share the same 
structure, this paper only analyzes the security of MCKBA and finds that the scheme can be broken with 
only four chosen plain-images. Both theoretical analysis and experimental results are provided to support 
the conclusion. In addition, some other security defects of MCKBA, including insensitivity with respect to 
changes of plain-image/secret key, are discussed. 

The rest of this paper is organized as follows. The image encryption algorithm under study is introduced 
in Sec. [2j Detailed cryptanalysis on the algorithm is presented in Sec. [3]with experimental results. The last 
section concludes this paper. 



2. Modified Chaotic-Key Based Algorithm (MCKBA) 

The plaintext encrypted by MCKBA is a gray-scale image of size M x N (width x height). The plain- image 
is scanned in the raster order and represented as a ID signal I = {I(i)} i=0 ~ . Then, a binary sequence 
I b = {IbQ)}™*' 1 is constructed, where £j =0 h(S ■ i + j) ■ V = I(i) V i € {0, • • • , MN - 1}. With a pre- 
defined integer parameter n, an n-bit number sequence J = {J(i)} i=0 is generated for encryption, 
where J(i) = X^=o -^>( n ' * + j) ' %* ■ Note that sequence Jj is padded with some zero bits if (8MN) is 
not a multiple of n. Without loss of generality, assume n can divide (8MN) here. MCKBA operate on 
the intermediate sequence J and get J 1 = {J'(i)} i=0 , where J'(i) = S?=o K( n ' * + j) ' ^ '■ Finally, 
cipher-image I' = {I'(i)} i=0 ~ is obtained, where I'(i) = Ylj=o^b(^ "* + j) ' ^ ■ With the above notations, 
MCKBA can be described as followqj. 



The secret key: two random numbers key±, key2 £ {0, 
of the following chaotic Logistic map: 



, 2 n — 1}, and the initial condition x(0) G (0, 1) 



x(i + l) = 3.9-s(i)-(l-o:(*)), (1) 

[n/2], keyi = ^i=o keyij ■ 2 J , key 2 = Y.]=o ^ e 2/2j ■ 2 J , and © denotes 



MN/(2n)-l 
i=0 



From the 32-bit 



where Yl]=o (keyij © key 2 j) 
eXclusive OR (XOR) operation. 

Initialization: run the chaotic system to generate a chaotic sequence, {x(i)} 

binary representation of x(i) = Ylj=i ^(32 ■ i + j — I) ■ 2~ J , derive a pseudo-random binary sequence 

(PRBS), {b(l)}^ IN/n -\ 

= ~ 8MN/n — 1, the corresponding cipher-element J'(i) 



Encryption: for the i-th. plain-element J(i) 
is determined by the following rule: 



J'{i) 



' (J(i) + keyi) ffifeeyi, 


if B{i) = 3 


(J(i) + keyi) Q keyi, 


if B(i) = 2 


(J(i) + key 2 ) key 2 , 


if B(i) = 1 


k (J(z) + key 2 ) Qkey 2 , 


if B{i) = 



(2) 



where B(i) = 2 • b(2i) + b(2i + 1), a + b = (a + b) mod 2 n and denotes XNOR operation. Since 



To make the presentation more concise and consistent, some notations in the original paper [Rao fc Gangadharl . 120071 ] are 
modified, and some details of MCKBA are also supplied. 



aQb = a®b 



b, the above equation is equivalent to 

' (J(i) + keyi) ffi keyi 
(J(i) + key x 



J'(i) 



key u 

(J(i) + keyi) ffi key 2 , 
k (J(i) + key 2 ) ®key 2 , 
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if B(<) 
if B(i) 
if B(<) 
if B(<) 



3, 
2. 
1. 
0. 



(3) 



Decryption: the decryption procedure is similar to that of the encryption, but with Eq. (J2j) replaced by 
following 



J(i) 



where a— b = (a — b + 2 n ) mod 2 n . 



'( J' (i)® keyi) -key i, if J5(i) = 3, 

(J'(i)®keJ[)-keyi, if B(i) = 2, 

(J'(i) © key 2 )-key 2 , if B(i) = 1, 

.(J'(i)<5)~key 2 ~)-key 2 , if J3(t) = 0, 



(4) 



3. Cryptanalysis 

3.1. TTie Differential Attack 

Differential attack is usually a chosen-plaintext attack, assuming that the attacker can obtain cipertexts 
for some set of chosen plaintexts. The goal of the attack is to gain information about the secret key 
or plaintext by analyzing how differences in the chosen plaintexts affect the resultant difference at the 
corresponding ciphertexts . Note that difference is defined with respect to any given operation, e.g., XOR. In 
(Rao & Gangadharl . I20071 . III.B] and JGangadhar fc Raol . lioiol . Sec. 3.2], the authors claimed that MCKBA 
is very robust against chosen-plaintext attack. However, we will show how it can be broken very easily with 
only four chosen plain-images. 

Since plain-image and intermediate sequences J can be obtained from each other without any secret 
key, choosing the former is actually equivalent to choosing the latter. If two known intermediate sequences 



^SMN/n-1 

encrypted results J[ = {J[(i)}°^q 



J\ = {Ji00} i=o and J 2 = {J 2 (i)} i=0 



8MN/n-l 



8MN/n-l 



are encrypted with the same secret key, their corresponding 

,8MN/n-l 



and J' 2 = {J 2 (i)}i = o 7 " ^ satisfy the following relation 



j[(i) ® 4(i) 



{ (Ji(t) + keyi) © (J 2 (») + keyx), if Bii) = 3, 

(Ji(i) + keyi) © {Hi) + keyi), if B(i) = 2, 

(Ji(t) + key 2 ) © (J 2 (i) + key 2 ), if B(i) = 1, 

[(Ji{i) + key 2 ) © (J 2 (i) + key 2 ), if Bii) = 0. 



(5) 



Regardless the value of B(i), (J[(i) © J 2 (i)) can be represented by an equation in the following form 

y = (a + x)®{b + x), (6) 

where a, b, x, y € {0, • • • , 2 n — 1}. 

The following theorem discusses how to solve the above equation. 

Theorem 1. Assume that a,b,x are all n-bit integers, then a lower bound on the number of queries (a,b) 
to solve Eq. ^) for any x is (i) if n = 1; (ii) 1 if n = 2; (Hi) 2 if n = 3; or (iv) 3 if n > 4. 



Proof. First, rewrite Eq. 



as the following equivalent form 

y = y © a ®b = (a + x) © (6 + x) 



Let x = YJj=o Xj-V,a = Ej=o aj-2 3 ,b = YJj=o h i • 2 J , and y = YJj=o Vj ' 2J ■ Then, except y = 0, Eq. © 



,j=o Xj-2 , a — 2^j=o a j ' ^ j b — z^j=o 
can be decomposed into the following iteration form 

Cj+l = (Xi ■ Oj) © (Xi 

[Xi ■ bi) ffi [Xi 

Ci+l ffiCj+l, 



a ffi b. 

yn~l ~ 



(7) 







ffi \&i ■ Ci), 

ffi (h ■ di), 



(8) 
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where i G {0, ■ ■ ■ , n — 2}, cq = 0, Co = 0. 

Table 1 lists the values of yi+i under all possible different values of aj,6j,£/j,Xj, q. From Table 1, one 
can see that the values of unknown bit Xi can be determined if and only if (a,i,bi,yi) falls in the 1, 2, 4, 
7-th column (zero-based) of the table, namely 

(a i + b i -2 + y i -2 2 ) €{1,2, 4, 7}. (9) 



Table 1. 


The values of yi+i corresponding to the values of a,;, 6j 


iVii^ii C-i' 








(ai,bi 


,y%) 








(a: " c ' t) (0,0,0) 


(0,0,1) 


(0,1,0) 


(0,1,1) 


(1,0,0) 


(1,0,1) 


(1 


,1,0) (1,1,1) 


(0, 0) 
(0, 1) 








1 


1 





1 




1 




1 
1 


(1, 0) 
(1, 1) 


1 
1 


1 




1 



1 






1 









When n = 1, Eq. (J7]) becomes y = 0. So, no pair of (a, b) is required to achieve the value of x. Since 
y n -\ bears no relation with x n _i, we only need to discuss how to obtain the (n — 1) least significant bits 
of x for other values of n. 

• n = 2: Since yo = 0, Co = 0, one can get xq = y\ by setting (ao, 6o) = (1,0); 

• n = 3: No matter what (an,&o) is, 2/1 € {0,1}- Therefore, it is impossible to obtain x\ with only 
set of (oi,6i) for any x. Select (a, 6) satisfying that (ao,6o) = (1,0), get xo as the above case. Let 
(oi, i»i) = (1,0), xi can be determined if y\ = 0; otherwise we have to resort to another query (a' , b'). Let 
y' = ^?=o Vj ' 2 J denote the output of Eq. ([7J) corresponding to the second query. Set (a' ,b' ) = (an,6o) 
and (a i, b^) = (1, 1) if y± = 1, then we can get xi = j/^i 

• n > 4: In this case, (2/1,2/2) and (2/1,2/2) can be all possible values. Observing Table 1, it can be easily 
verified that there is no (a, b) and (a',b') satisfying either Eq. ([9]) or 

K + &^ • 2 + $-2 2 ) €{1,2,4,7} (10) 

for i = 1,2. This means x<i cannot always be determined. Therefore, we need one more 
query (a* = X^?=o a *j ' 2 J , &* = S?=o tf ' 2 J ). Let y* = ^?=o Vj ' ^ denote the correspond- 
ing output with respect to Eq. ([7]). Given a set of (aj+fc, &i+fc, o^ +fc , b' i+k ,a* +k , b* +k ), one can get 
(ci +fc+ i,yi +fe+ i,c; +fc+1 ,^ +fc+1 ,c* +fe+1 ,y*- fc+1 ) from (c i+fc , j/ i+fc ,^ +fe ,^ +fc ,c* +fc ,y* +fc ) and value of x i+fe , 
where i, fc G Z. Let arrows of plain head and "V-back" head denote Xj + fc = and Xi +k = 1 
respectively, Figure [Q illustrates mapping relationship between (ci + k,yi+k,c' i+k ,y' i+k ,c* +k ,y* +k ) and 
(ci +fc+ i,yi +fe+ i,4 +fc+1 ,^ +fc+1 ,c^ +fe+1 ,y* +fe+1 ) for a given {a i+k ,b i+k ,a' i+k ,b' i+k ,a* +k ,b* +k ), where fc = 
0, 1, 2. Since (co, 2/0, Cq, t/q, c 0) 2/o) = (0, 0, 0, 0, 0, 0), the dashed arrows in Fig. [1] describe Eq. (jHJ) with the 
three sets of (a, b) for i = 0, 1, 2. Note that the data in the fourth column of the table shown in Fig. [1] 
is exactly the same as the first one. Therefore, Fig. Q] shows calculation of Eq. ([7]) under all different bit 
levels if the variable i shown in Fig. Q] go through 3 • t, where t = ~ |_ n /3j an d i + k < n — 1. From 
Fig. [H it can be easily verified that the following relationship 

(a i+k + b i+k ■ 2 + y i+k ■ 2 2 , a' i+k + ^ +fc • 2 + y' l+k ■ 2 2 ,a* +k + b\+ k ■ 2 + y* +fc • 2 2 ) n {1, 2, 4, 7} ^ (11) 

is always satisfied, which means Xi +k can be derived from Table 13.11 This completes the proof. 



Corollary 3.1. The (n — 1) least significant bits of x in Eq. (0) can be determined easily by setting (a, b) 
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Fig. 1. Relationship between (c i+k ,y i+k ,c' l+k ,y i+k ,c* +k ,y* +k ) and (c i+k+1 , y i+k+1 , c' i+k+1 , y i+k+1 , c* +k+1 , yt+k+l) for a 
given (a i+k , b i+k , a' i+k , b' i+k ,a* +k ,b* +k ), where k = 0, 1, 2. 

wii/t £/ie following three sets of numbers 

Elir^ 100 ) 2 • 8J ) mod 2 "' (E^" 1 ^ 1 )- • 8J ) mod 2 "} : 

^^(lOOb • tf) mod 2", (Ef = r>01) 2 • 8 j ) niod 2"} ; 

X)-X 31-1 ( 011 )2 ' 8J ) mod 2 "' fe-^ 31 "^ 001 ) 2 ' 8J ) m ° d 2 ™} 

and checking the corresponding y = y ffi a ffi o. 

Proof. The proof is straightforward. ■ 

Proposition 1. Assume that a and x are both n-bit integers, n € Z + , one has the following two equations 

(a ffi x)-x = (a ffi x ffi 2 n ~ 1 )-(x ffi 2 n ~ 1 ), 
(a ffi x)-x = (a ffi x©2 n - 1 )-(x © 2 re_1 ). 



Proof. Eq. (fTZj) can be proved under four conditions, i) When (affix) > 2 n and x > 2 n : (a ffi x ffi 



in— 1^ 



-(xffi2 



n-ll 



((affix) 



m- 1 N 



-(x-2 



n-ll 



(((affix)-2 n - 1 )-(x-2 n - i ) + 2 n )mod2 



affix —x; 



ii) When (a ffi x) > 2 n ~ l and x < 2 n ~ 1 : (affix© 2 n " 1 )-(x ffi 2 n ~ l ) = ((a ffi x) - 2 n " 1 )-(x + 2 n ~ l ) = 
(((a ffi x) - 2 n ~ 1 ) - (x + 2"" 1 ) + 2 n ) mod 2 n ---- (a ffi x)-x; iii) When (a ffi x) < 2 n ~ l and x > 2 n ~ 
(affix 



m- In 



)-(x ffi 2 n ~ 1 ) = ((a ffi x) + 2 n " 1 )-(x 



tn— 1> 



(a ffi x)-x; iv) When (affix) < 2 n_1 and 



x < 2 n ~ 1 : (a ffi x ffi 2"- 1 )-(x ffi 2 71 - 1 ) = ((a ffi x) + 2"" 1 )-(x + 2™- 1 ) = (a ffi x)-x. Similarly, Eq. (p} can 
be proved. ■ 
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Corollary 13. II means that one can only choose four intermediate sequences, Jq, «7i, Ji and J3, to break 
MCKBA, where 

x-^rn/31-l 

J i«^£-lo 31 " l7 - 8J ) mod2n ' ( 12 ) 

.— Jn/31-1 
J 2» = (E,- =0 4 - 8 ') mod2n ' 

J 3W^(E- =0 6 - 8 ') mod2 "- 

With respect to the ID representation of 2D images defined in Sec. [21 basic repeated pattern of the corre- 
sponding gray-scale images of J , Ji, J 2 and J 3 are [73, 146, 36], [255, 255, 255], [36, 73, 146], [182, 109, 219], 
respectively. As shown in Proposition [H the unknown most significant bits of key\ and/or keyi have no 
influence on decryption of MCKBA, so they are considered being recovered correctly in rest of the paper. 
Let key*(i) denote solution of Eq. (JSJ) for i = ~ MN/(2n) — 1, then {key*(i)} i=Q can be used as 

an equivalent key to decrypt any cipher-images of smaller size, encrypted with the same secret key. 

The complexity of the differential attack is mainly determined by verifying the n—1 bits of each element 
in {key*(i)} i=0 from Table [3TTT so the complexity is proportional to the size of the plain-image. 

3.2. Breaking the Secret Key 

The differential attack described in the above subsection only outputs an equivalent key. We will show that 
the secret key can be further derived from it. 

Assume {b(l)} distributes over {0,1} uniformly, the probability key\ $ (key*(i)) i=0 or key2 $ 

(key*(i)) i=0 is (l/2) 8MN ' n . So, we can obtain set (keyi,key2) with a very high probability 1 — 

^/2)8MJV/n-l_ Since Y^zlikey^j ■ V) ^ E"=o( fee 2/2j ■ 2 J ), one can narrow the scope of B(i) from Eq. © 
as follows 

f {2,3}, if £-=oW(% • 2>) = E"=o(^yij • 2*), 
U \{0,1}, ifEi=o(^*(%-2 J )=E-=o(^2,i-^'), l ] 

where tey*(i) = E^oWWi " 2i ) and *ey*(i) = E]S(*ey*(i)j -2?'). 

Proposition 2. Assume that a and x are both n-bit integers, n G Z + , if a is odd, then p = ((a + x) © x) is 
always odd and q = ((a + x) x) is always even. 

Proof. This proposition can be proved by two equations 

((1 + x ) mod 2) x = 1, 
((1 + x ) mod 2) x Q = 0. 



From Proposition [2] and Eq. ([2]), one can narrow the scope of B(i) also according to encryption result 
of the second chosen intermediate sequence shown in Eq. (|12p , as follows 



I {0,2}, if J[(i) is even. 

Once fceyi and key2 are determined, value of B(i), for i = ~ 8MN/n — 1, can be determined 
exactly from Eq. (jl3[) and Eq. (I14p . There are only two possible combinations of key\ and key2- If the 
searched version is the right one, {B(i)} i=0 can be constructed correctly. Let {B*(i)} i=0 and 

{B*(i)} i=0 denote the obtained version of {B(i)} i=0 corresponding to the two combinations of 
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keyi and key2- Since Eq. (|14[) is unrelated with keyi and key2, one can assure that B*{i) = B*{i) © 2, i.e, 
6*(2t) = 1 - 6*(2t) and 6*(2i + 1) = 6*(2i + 1), for i = ~ 8MN/n - 1. Construct {x*(i)}^ /(2n)_1 and 
K(i)}^ /(2n)_1 , where x*(i) = E?=i ^(32 ■ * + j - 1) ■ 2^', x*(i) = Zf=i b*(32 ■ i + j - 1) • 2"'. 

Since {^c(i)}j = o come from consecutive chaotic states generated by iterating Logistic map, we 

can distinguish {x*(i)} i=Q or {x*(i)} i=0 is the right sequence controlling encryption process, 

and verify keyi and key2 corresponding ly, by checking wh e ther any two consecutive elements of them 
satisfy specific correlation. As shown in [Rao fc Gangadharl . 120071 . Table 3], Eq. flTJ) is realized in 32-bit 



fixed-point arithmetic precision. So MCKBA satisfies condition described in Proposition The whole 

secret key of MCKBA can be verified by checking whether some consecutive elements in {x*(i)} i=0 

and {x*(i)} i=0 satisfy Eq. (fl~5]) . Finally, keyi, key2, and x(0) = Y^j=i b(J ~~ 1) ' 2 J can be recovered. 

For HCKBA, we have to chec k which sequence agrees w ith distribution of the chaotic states generated by 
the hyperchaos generator like Gangadhar <fe Raol . I2010I . Fig. 6]. 



Proposition 3. Assume that the Logistic map x(k + l) = /j, ■ x(k) ■ (1 — x(k)) is iterated with L -bit fixed-point 
arithmetic and that x(k + 1) > 2~ m , where 1 < m < L. Then, the following inequality holds 

|/x-/i fc |<2 m+3 /2 L , (15) 

where ji k = xik *^ m • 



Proof. See appendix of [Li et all l2008bl ] . 



3.3. Experimental Results 

To verify the real performance of the above analysis, some experiments are carried out on some plain-images 
of size 512 x 512 when n = 32. The four chosen plain-images are shown in Fig.[2j When xq = 319684607/2 32 , 
keyi = 3835288501, and key2 = 1437224678, the encryption results of the four chosen-image are shown 
in Fig. [3l Equivalent key {key*(i)} i=0 is used to decrypt another cipher-image shown in Fig. [Jh) 

and the recovered result is shown in Fig. Hb). Three parts of the whole secret key, keyi, key2 and the 32 

bits of x(0) can be verified by checking only three pairs of consecutive elements in {x*(i)} i=0 and 

3.4. Some Remarks on the Performance of MCKBA 

• Insufficient randomness of PRBS {&(/)} 

It is well-known that distribution of chaotic states generated by iterating Logistic map is not uniform, 
which makes randomnes s of derived binary bit sequence from them very low. As this point has been 
shown quantitatively in Li et all 120071 . 120101 ]. detailed discussion is omitted here. 



• Insensitivity with respect to changes of plain-image 

This defect may cause serious threat for any secure image encryption algorithm since image and its 
watermarked version may be encrypted at the same time. From Eq. ([2"]). one can see that change of 
the m-th significant bit of J(i) may only change the m ~ (n — l)-th significant bits of J'(i), where 
< m < n. This means MCKBA can make change of one bit of plain-image to influence at most n bits 
in the corresponding cipher-image. 

• Insensitivity with respect to changes of two sub-keys 

Obviously, any secure encryption algorithm should avoid this defect. Unfortunately, MCKBA is seriously 
fragile in this aspect. From Eq. ([2]), one can see that change of one bit of keyi or key2 only influences 
one bit of the corresponding cipher-image. 

4. Conclusion 

In this paper, security of the image encryption algorithm MCKBA has been studied in detail. It was found 
that the whole secret key can be recovered correctly with only four chosen plain-images. In addition, some 
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c) d) 

Fig. 2. Four chosen plain- images (The black boundary of Fig. [2]b) is not its part). 

other defects of the algorithm, including insensitivity with respect to changes of plain-image/secret key, 
were discussed. Analogue of MCKBA, HCKBA, have the same security problems. Due to such a low level 
of security provided by the two schemes (essentially one scheme), their application in practice should be 
performed with extreme caution. 
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